Bleichenbacher Attack in Fastapi with Dynamodb

A Bleichenbacher attack is a cryptographic padding oracle attack originally described against RSA PKCS#1 v1.5. In a Fastapi service that uses Dynamodb as a backing store, the risk arises when the application performs decryption or signature verification using a public-key algorithm and reveals distinguishable error behavior based on padding validity. If Fastapi endpoints accept encrypted or signed tokens (e.g., JWTs) and query Dynamodb to retrieve keys or reference data, subtle timing differences or error messages returned for malformed ciphertext can enable an attacker to decrypt or forge tokens without the private key.

Consider a Fastapi endpoint that receives an encrypted payload, sends it to Dynamodb to look up a key identifier, and then performs decryption. If the endpoint returns different HTTP status codes or response bodies for invalid padding versus other errors, it effectively acts as a padding oracle. An attacker can iteratively modify the ciphertext and observe responses to gradually reveal the plaintext. Dynamodb does not introduce the vulnerability, but its use for key or token metadata can become part of the oracle path: the application may first fetch an item from Dynamodb (e.g., a JSON document containing a public key or key metadata) and then perform cryptographic operations. If error handling around the Dynamodb fetch or the subsequent decryption is inconsistent, the combination exposes a Bleichenbacher-style oracle.

In Fastapi, a typical risky pattern is an endpoint that deserializes a token, queries Dynamodb for a related key document, and attempts JWT decryption with asymmetric keys. For example, if the endpoint does not use constant-time checks and returns 400 with 'Invalid padding' for bad padding but 401 for invalid signature, it leaks information. The presence of Dynamodb can amplify risks if key retrieval logic is intertwined with validation logic and error messages are not uniformly handled. Attackers can send many crafted requests, each causing distinct error paths involving Dynamodb lookups or cryptographic operations, and infer validity from status codes or timing.

To assess this with middleBrick, you would submit the Fastapi endpoint URL. The scanner runs 12 security checks in parallel, including Input Validation and Authentication, and can detect server-side behaviors consistent with oracle leakage. It also performs active prompt injection and system prompt leakage testing for LLM endpoints if your service exposes AI features, but for a Bleichenbacher scenario the focus is on unauthenticated attack surface testing and input validation checks that observe how the API reacts to malformed or maliciously crafted ciphertexts.

Remediation guidance centers on making error handling uniform and avoiding information leaks. Use constant-time comparison for cryptographic operations, ensure that all failure paths return the same HTTP status and generic message, and avoid exposing distinct errors for database versus cryptographic failures. Do not rely on client-supplied key identifiers to drive sensitive operations without strict validation. middleBrick can scan the unauthenticated surface and highlight inconsistent error behaviors; its findings map to OWASP API Top 10 and related compliance frameworks, providing prioritized remediation steps rather than attempting to fix the implementation directly.

To mitigate Bleichenbacher-style risks in Fastapi when using Dynamodb, ensure that cryptographic operations and error handling are consistent and that Dynamodb interactions do not leak validity information. Below are concrete, safe patterns with working code examples.

1. Use constant-time operations and uniform error responses. Never branch on padding validity. Always fetch keys from Dynamodb using a stable, permissioned access pattern and handle missing items gracefully without revealing which part failed.

from fastapi import FastAPI, HTTPException, Depends
from pydantic import BaseModel
import boto3
from botocore.exceptions import ClientError
import hmac
import hashlib
import time

app = FastAPI()
ddb = boto3.resource('dynamodb', region_name='us-east-1')
table = ddb.Table('KeyMetadata')

class KeyRef(BaseModel):
    key_id: str
    algorithm: str

# Constant-time comparison helper
def safe_compare(a: bytes, b: bytes) -> bool:
    return hmac.compare_digest(a, b)

# Secure key retrieval with uniform error handling
def get_key(key_id: str) -> bytes:
    try:
        resp = table.get_item(Key={'key_id': key_id})
        item = resp.get('Item')
        if not item or 'public_key_pem' not in item:
            # Return a dummy key to avoid leaking existence via timing or status
            return b'dummy_for_constant_timing'
        return item['public_key_pem'].encode('utf-8')
    except ClientError as e:
        # Log internally, but return generic response to caller
        raise HTTPException(status_code=400, detail='Invalid request')

@app.post('/decrypt')
async def decrypt_payload(payload: dict):
    try:
        key = get_key(payload.get('key_id', ''))
        # Perform cryptographic operation with constant-time checks
        # Replace with actual JWT or decryption logic using key
        # Ensure all exceptions map to a generic 400 response
        raise HTTPException(status_code=400, detail='Invalid request')
    except HTTPException:
        raise
    except Exception:
        raise HTTPException(status_code=400, detail='Invalid request')

2. Avoid using Dynamodb conditional checks that create timing side channels. When retrieving key metadata, prefer a single GetItem with a consistent response shape rather than multiple branches that reveal item existence. If you must handle different error conditions, map them to the same HTTP status and body structure.

# Anti-pattern to avoid: branching on item existence
# Prefer a single path with dummy data if item not found
def get_key_safe(key_id: str) -> bytes:
    try:
        resp = table.get_item(Key={'key_id': key_id})
        item = resp.get('Item')
        # Always return bytes; do not reveal missing key via timing or status
        if item and 'public_key_pem' in item:
            return item['public_key_pem'].encode('utf-8')
        return b'dummy_for_constant_timing'
    except ClientError:
        return b'dummy_for_constant_timing'

3. For JWT validation, use well-audited libraries that enforce constant-time verification and do not rely on manual padding checks. If you integrate LLM features that may call APIs, ensure that any endpoint exposed to the LLM also follows these patterns to prevent indirect oracle paths.

middleBrick can scan your Fastapi endpoints and Dynamodb interactions to highlight inconsistent error handling and potential oracle behavior. Its findings include prioritized remediation guidance aligned with OWASP API Top 10 and compliance mappings, helping you address Bleichenbacher-like risks without exposing internal mechanisms.